Dashboards & Visualizations

how to break multiple values of a column into a new column name

kdoma
Explorer

How to break multiple values of a column into new column name?

Swipe_Entry_Type
In
In
In
Out
Out
Out

Swipe_Entry_Type_In
In
In
In

Swipe_Entry_Type_Out
Out
Out
Out

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your current search giving fields Swipe_Entry_Type,Swipe_Time,Department,Student,Name 
| eval Swipe_Entry_In=if(Swipe_Entry_Type="In",Swipe_Entry_Type,null()) 
| eval Swipe_Entry_Out=if(Swipe_Entry_Type="Out",Swipe_Entry_Type,null()) 
| stats values(Swipe_Entry_In) as Swipe_Entry_In values(Swipe_Entry_Out) as Swipe_Entry_Out by Department,Student,Name
| table Name Swipe_Entry_In Swipe_Entry_Out Department Student
0 Karma

kdoma
Explorer

I want to convert Swipe_Time into Swipe_Time_In and Swipe_Time_Out based on the values

Swipe_Entry_Type,Swipe_Time,Department,Student,Name
In,2015-07-28 09:00:01 AM,CSE,CB049201,Sumanth
In,2015-07-28 09:00:01 AM,CSE,CB049202,Ramya
Out,2015-07-28 05:08:01 PM,CSE,CB049201,Sumanth
Out,2015-07-28 05:08:01 PM,CSE,CB049202,Ramya

if it is AM then new column as Swipe_Time_In and if it is PM then new column as Swipe_Time_Out

0 Karma

sundareshr
Legend

Try this

base search | mvexpand Swipe_Entry_Type | stats values(eval(Swipe_Entry_Type="In")) as Swipe_Entry_Type_In values(eval(Swipe_Entry_Type="Out")) as Swipe_Entry_Type_Out | table Swipe_Entry_Type_In Swipe_Entry_Type_Out 
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Is Swipe_Entry_Type a multivalued field OR regular fields (single value per row). Share the query which is getting you this.

0 Karma

kdoma
Explorer

My Input:

Swipe_Entry_Type,Swipe_Time,Department,Student,Name
In,2015-07-28 09:00:01 AM,CSE,CB049201,Sumanth
In,2015-07-28 09:00:01 AM,CSE,CB049202,Ramya
Out,2015-07-28 05:08:01 PM,CSE,CB049201,Sumanth
Out,2015-07-28 05:08:01 PM,CSE,CB049202,Ramya

output should be
Name Swipe_Entry_In Swipe_Entry_Out Time_Entry_In Time_entry_Out Department Student
Sumanth In Out Time Tine CSE CB049201

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...